Don't use IDENT_SRC_URL for HttpAuth challenges. IE hasn't supported it for years, and at worst ...

net/http/http_auth_controller.cc

Index: net/http/http_auth_controller.cc
===================================================================
--- net/http/http_auth_controller.cc	(revision 120359)
+++ net/http/http_auth_controller.cc	(working copy)
@@ -247,8 +247,7 @@
 
 int HttpAuthController::HandleAuthChallenge(
     scoped_refptr<HttpResponseHeaders> headers,
-    bool do_not_send_server_auth,
-    bool establishing_tunnel,
+    int challenge_option_mask,
     const BoundNetLog& net_log) {
   DCHECK(CalledOnValidThread());
   DCHECK(headers);
@@ -307,8 +306,9 @@
 
   identity_.invalid = true;
 
-  bool can_send_auth = (target_ != HttpAuth::AUTH_SERVER ||
-                        !do_not_send_server_auth);
+  bool can_send_auth =
+      (target_ != HttpAuth::AUTH_SERVER ||
+       (challenge_option_mask & CHALLENGE_OPTION_SEND_SERVER_AUTH));
 
   do {
     if (!handler_.get() && can_send_auth) {
@@ -322,7 +322,7 @@
     }
 
     if (!handler_.get()) {
-      if (establishing_tunnel) {
+      if (challenge_option_mask & CHALLENGE_OPTION_ESTABLISHING_TUNNEL) {
         LOG(ERROR) << "Can't perform auth to the "
                    << HttpAuth::GetAuthTargetString(target_) << " "
                    << auth_origin_ << " when establishing a tunnel"
@@ -342,7 +342,7 @@
     if (handler_->NeedsIdentity()) {
       // Pick a new auth identity to try, by looking to the URL and auth cache.
       // If an identity to try is found, it is saved to identity_.
-      SelectNextAuthIdentityToTry();
+      SelectNextAuthIdentityToTry(challenge_option_mask);
     } else {
       // Proceed with the existing identity or a null identity.
       identity_.invalid = false;
@@ -445,13 +445,15 @@
                            handler_->auth_scheme(), identity_.credentials);
 }
 
-bool HttpAuthController::SelectNextAuthIdentityToTry() {
+bool HttpAuthController::SelectNextAuthIdentityToTry(
+    int challenge_option_mask) {
   DCHECK(CalledOnValidThread());
   DCHECK(handler_.get());
   DCHECK(identity_.invalid);
 
   // Try to use the username:password encoded into the URL first.
   if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() &&
+      (challenge_option_mask & CHALLENGE_OPTION_USE_EMBEDDED_AUTH) &&
       !embedded_identity_used_) {
     identity_.source = HttpAuth::IDENT_SRC_URL;
     identity_.invalid = false;